; Test S_LBM_LISP_ARRAY vulnerability
; Create malicious lisp array data claiming more elements than buffer contains

(print "Testing S_LBM_LISP_ARRAY vulnerability...")

; Create malicious data: S_LBM_LISP_ARRAY claiming 4 elements but only 1 element worth of data
(define malicious-lisp-data [
  0x1F          ; S_LBM_LISP_ARRAY type tag  
  0x00 0x00 0x00 0x04  ; Claims 4 elements (big-endian)
  0x05          ; S_I28_VALUE type tag for first element
  0x00 0x00 0x00 0x42  ; One integer value (66)
  ; Missing data for the other 3 claimed elements - this should expose vulnerability
])

; Try to unflatten the malicious data
(define result (trap (unflatten malicious-lisp-data)))

(if (eq (car result) 'exit-ok)
    {
        (define created-result (car (cdr result)))
        ; Check if result is a safe value (symbol or nil) like the C test does
        (if (or (eq created-result nil) (eq (type-of created-result) 'type-symbol))
            {
                (print "SUCCESS")
                (print "unflatten returned safe value for insufficient data")
            }
            {
                (print "VULNERABILITY DETECTED!")
                (print "unflatten succeeded with insufficient lisp array data")
                (print "Created unsafe result:" created-result)
                (print "Result type:" (type-of created-result))
            })
    }
    {
        (print "SUCCESS")
        (print "unflatten correctly rejected insufficient data")
    })